US agencies warn of OT pre-positioning and water attacks

Volt Typhoon pre-positioning and exposed-controller attacks have disrupted US water systems in at least seven states since July 2026.

US agencies assess that China's Volt Typhoon has pre-positioned in critical-infrastructure IT networks spanning communications, energy, transportation, water systems, and Guam, using exposed appliances, valid administrative credentials, and living-off-the-land techniques, with persistence of at least five years in some environments. Since July 27, 2026, water and wastewater utilities in at least seven states reported attacks on internet-facing Rockwell Automation Allen-Bradley MicroLogix 1100 and 1400 controllers in which intruders changed passwords and network settings and, in at least one case, altered controller logic, causing flooding and lost pressure. The FBI said sufficiently low pressure could draw untreated groundwater into pipes, though contamination was not confirmed. Sources disagree on attribution: one says the July water activity has not been publicly attributed and separately reports that CyberAv3ngers compromised at least 75 Unitronics devices between November 2023 and January 2024 with default or missing passwords, while another describes Iranian-affiliated actors abusing internet-facing Rockwell Allen-Bradley PLCs. NSA also warned of reconnaissance and AI-generated scripts aimed at Siemens S7 PLCs. Agencies frame Volt Typhoon's access as preparation for possible later operational disruption rather than confirmed OT sabotage.